chore(deps): bump go.pinniped.dev from 0.23.0 to 0.38.0

[dependabot]

Bumps go.pinniped.dev from 0.23.0 to 0.38.0.

Release notes

Sourced from go.pinniped.dev's releases.

v0.38.0

Release v0.38.0

Release Image

Image	Registry
ghcr.io/vmware-tanzu/pinniped/pinniped-server:v0.38.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.38.0	DockerHub

These images can also be referenced by their digest: sha256:cc1769112d738ff95a3f8430d254d8546fc254d2cbc065f916b88d83ceb22c65.

Changes

This release includes several new features and upgrades project dependencies.

Minor Changes

• The Pinniped Supervisor now supports using response_mode=form_post with an OIDCIdentityProvider. Some versions of ADFS might require this in order for Pinniped to receive certain claims in the ADFS-issued ID token. (#2254)
• The pinniped get kubeconfig CLI command now auto-discovers the issuer's CA bundle from a JWTAuthenticator's spec.TLS.CertificateAuthorityDataSource, and this CA bundle is written into the resulting kubeconfig. (#2193)
• The FederationDomain.spec.issuer field must start with https://. This was previously validated after the resource was created. Now this validation will cause resource creation to fail. (#2167)
• The long-deprecated CredentialIssuer.status.kubeConfigInfo field has been removed. (#2167)
• Both the Pinniped Supervisor and the Pinniped Concierge have a new configuration option available in their respective ConfigMaps to disable various types of dynamic admission plugins for their aggregated APIs. It is not typically necessary to disable these admission plugins. This feature was added because having lots of ValidatingAdmissionPolicies on your cluster can cause the Pinniped and Kubernetes API server pods to use lots of memory. For more information, see the description of PR #2269. (#2269)
• When compiling for FIPS compatibility, this release is designed to be used with Go 1.24, which included an updated version of boringcrypto. Note that Pinniped is still designed to be used with GOEXPERIMENT=boringcrypto, and has not yet been tested with Go 1.24's new fips140 GODEBUG setting. When compiled using hack/Dockerfile_fips, the Pinniped Concierge and Supervisor servers will allow the use of both TLS 1.2 and TLS 1.3, because Go 1.24 now supports both with its updated version of boringcrypto. As a result, the fips_enable_tls13_max_for_default_profile build tag, which could previously be used to allow the use of TLS 1.3 in FIPS-compatible mode, is no longer needed, as that is now the default behavior. Also drops the use of two insecure ciphers that have been dropped by boringcrypto. (#2203)
• Updates the Kubernetes libraries to v0.31.6, Golang to v1.24.1, and updates all other project dependencies. (#2276, #2268, #2266, #2264, #2249, #2239, #2236, #2233, #2228, #2209, #2205, #2197, #2196, #2195, #2192, #2191, #2190, #2189, #2188, #2187, #2186, #2278)
• Some additional changes were made to improve tests. (#2253, #2250)

Diffs

A complete list of changes (81 commits, 179 changed files with 2,049 additions and 1,535 deletions) can be found here.

Acknowledgements

• Thanks to @​devantler for reporting the issue fixed by #2193.
• Thanks to @​graindcafe for reporting the issue fixed by #2254.

v0.37.0

Release v0.37.0

Release Image

Image	Registry
ghcr.io/vmware-tanzu/pinniped/pinniped-server:v0.37.0	GitHub Container Registry
docker.io/getpinniped/pinniped-server:v0.37.0	DockerHub

These images can also be referenced by their digest: sha256:ec64e6b4b5b4c70740582134bef9e249bdd8760dfde45880a862a4389cd2b809.

Changes

... (truncated)

Commits

• cf98c69 Merge pull request #2283 from vmware-tanzu/pinny/bump-deps
• 62f6d85 Merge pull request #2278 from vmware-tanzu/upgrade_deps_march_2025
• 604ecc5 Bump dependencies
• a010794 generated code changes from running update.sh
• c7462bf update kube-versions.txt
• b396d12 update Dockerfile and README copyright years
• 695ea3a upgrade linter
• d625ada upgrade github.com/google/go-github and k8s.io packages
• 0f48620 Merge pull request #2276 from vmware-tanzu/pinny/bump-deps
• c2496aa Bump dependencies
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.